Conventionally known is a reactor protection system in which, in a case where a nuclear facility is in an abnormal state of operation, a reactor trip and an engineered safety feature are actuated, in consideration of a common cause failure (common mode failure) on software(for example, refer to Patent Literature 1). This reactor protection system has two comparison logic processor modules, and the two comparison logic processor modules have different kinds of CPUs. One comparison logic processor module processes input data in a first processing order to output a trip state signal. The other comparison logic processor module processes input data in a second processing order, which is a reverse direction of the first processing order, to output a trip state signal. Accordingly, since the trip state signal can be output with the use of the other comparison logic processor module, which is different from the one comparison logic processor module, in this reactor protection system, this reactor protection system can exclude a common cause failure.